Binance reopened withdrawals at 06:00 UTC on 1 November 2026, three days after the $6.3B hack. We counted the transfers leaving its published reserve addresses on all 15 reopened networks.
In the first 26 hours, $6.96B left in 735,608 transfers. That is more than the attackers stole. Half a million addresses took part, but 87 of them took 40% of the money.
Data window: 06:00 UTC on 1 November to 08:00 UTC on 2 November 2026. These are our own on-chain counts, checked against the figures Binance published.
The short version
- Gross withdrawals: $6.96B measured, plus an estimated $18M to $58M in native coins we could only sample. That is 4.1% of the $171B in assets Binance reported on 28 October.
- Net outflow: our estimate is $5.5B to $5.9B by 08:00 UTC on 2 November. Binance's official net figure, $3.64B, covers only the first 9.5 hours.
- Concentration: 87 addresses took $2.77B. The median address took $116.
- What left: 69% of the value was stablecoins. USDT alone was 50%.
- Fees: Binance earned at most about $675K, or 0.01% of the value. Tron brought 79% of that.
Why every headline shows a different number
You may have seen $3.64B, $4.65B, $6.1B or $7B. They measure different things over different windows.
| Measure | Window (UTC) | Amount |
|---|---|---|
| Binance: withdrawals | 1 Nov, 06:00 to 15:30 | $4.649B |
| Binance: net of deposits | 1 Nov, 06:00 to 15:30 | -$3.638B |
| Our count: withdrawals | 1 Nov, 06:00 to 15:30 | $4.596B |
| Our count: withdrawals | 1 Nov 06:00 to 2 Nov 08:00 | $6.96B |
| DefiLlama: balance change | 1 Nov 00:00 to 2 Nov 07:55 | -$7.07B |
| DefiLlama: without price effect | 1 Nov 00:00 to 2 Nov 07:55 | -$7.45B |
| Our net estimate | to 2 Nov 08:00 | -$5.5B to -$5.9B |
Wallet balances overstate customer outflows, because they also fall when an exchange moves funds to new addresses. DefiLlama shows Zcash holdings down $863M, while actual ZEC withdrawals were $44M. CoinDesk's report of about $6.1B leaving also rests on DefiLlama and carries the same warning.
We reached a net estimate in two ways. Taking DefiLlama's price-adjusted $7.45B and removing four items that are not customer withdrawals gives about $5.9B: the ZEC gap ($819M), bitcoin hot wallet top-ups ($347M) and two large USDT transfers missing from Binance's own chart ($339M together). Applying the deposit rate from Binance's official window (21.7% of withdrawals) to about $7.0B gives about $5.5B.
Treat that range as an estimate. Deposits after 15:30 UTC on 1 November are not public.
Who took the money
We grouped 504,723 addresses by the total each one received.
| Total per address | Addresses | Value |
|---|---|---|
| Under $100 | 238,836 · 47.3% | $8.5M · 0.1% |
| $100 to $1K | 163,531 · 32.4% | $61.9M · 0.9% |
| $1K to $10K | 76,199 · 15.1% | $255.9M · 3.7% |
| $10K to $100K | 21,225 · 4.2% | $654.0M · 9.4% |
| $100K to $1M | 4,171 · 0.83% | $1.21B · 17.4% |
| $1M to $10M | 674 · 0.13% | $2.00B · 28.7% |
| Over $10M | 87 · 0.02% | $2.77B · 39.8% |
Bars show share of addresses (cyan) and share of value (orange).
Addresses under $10K made up 94.8% of the count and 4.7% of the value. The 87 largest received $2.77B. The top 10 took 16.0%, the top 100 took 41.6% and the top 1,000 took 71.5%.
Single transfers look similar. 83% were under $1K and carried 1.4% of the value, while 70 transfers above $10M carried $1.28B. The largest we found was about $35.9M in bitcoin at 06:46 UTC, 46 minutes after reopening.
So most people who moved funds moved small amounts, and most of the money moved in large tickets. An address is not a person, though. The top addresses have no public labels, so some could be other exchanges, market makers or custodians acting for many clients.
Which chains and coins it left through
| Network | Value | Transfers | Fees |
|---|---|---|---|
| Ethereum | $3.35B | 93,062 | $56,207 |
| Bitcoin | $1.56B | 38,594 | $60,113 |
| Tron | $846.6M | 147,289 | $533,413 |
| BNB Chain | $558.0M | 372,873 | $3,578 |
| Solana | $314.8M | 43,653 | $12,752 |
| Base | $62.3M | 3,550 | $710 |
| Avalanche | $59.6M | 4,244 | $176 |
| XRP Ledger | $53.3M | 7,616 | $1,910 |
| Arbitrum | $51.5M | 8,670 | $3,017 |
| Zcash | $43.7M | 559 | $347 |
| Dogecoin | $20.6M | 3,026 | $917 |
| Polygon | $13.3M | 4,588 | $393 |
| Optimism | $11.3M | 2,158 | $92 |
| Sui | $7.7M | 1,477 | $80 |
| TON | $4.1M | 4,249 | $946 |
| Total | $6.96B | 735,608 | $674,651 |
Fees use Binance's public rates, before network costs. Native BNB, POL and ETH on Base and Arbitrum are not included in this table.
Ethereum carried 48% of the value. BNB Chain carried 51% of the transfers and 8% of the value. The average BNB Chain withdrawal was about $1,500, against about $36,000 on Ethereum and about $40,500 on Bitcoin.
By coin, USDT led with $3.48B (50.0%), followed by BTC with $1.56B (22.5%), USDC with $1.31B (18.8%) and ETH with $379M (5.4%). Everything else added up to 3.3%.
What Binance earned on the way out
Binance charges a flat fee per withdrawal, set by network and coin. A $10M transfer pays the same as a $100 one, so the fee revenue follows the number of transfers on expensive networks, not the value leaving.
| Route | Fee per withdrawal | Transfers | Earned |
|---|---|---|---|
| Tron USDT | 4 USDT | 131,666 | $526.1K |
| Bitcoin | 0.00002 BTC | 38,594 | $60.1K |
| Ethereum USDT | 0.6 USDT | 65,268 | $39.1K |
| Ethereum USDC | 1 USDC | 11,562 | $11.6K |
| BNB Chain USDT | 0.01 USDT | 358,148 | $3.6K |
| All other routes | varies | 130,370 | $34.1K |
| Total | 735,608 | $674.7K |
That makes Tron the outlier. USDT on Tron costs 4 USDT, so the network produced 79% of fee revenue from 12% of the value. On BNB Chain the same stablecoin costs 0.01 USDT. A $100 withdrawal on Tron pays 4%, and a $1M withdrawal pays 0.0004%.
$675K is a ceiling, calculated from Binance's public fee table as of 2 November. Withdrawal amounts on-chain confirm the fee on the largest routes. For example, 37.9% of Ethereum USDT amounts end in .40, which is a round number minus 0.6 USDT. Some users may have paid no fee, or entered the amount net of it.
After network costs of about $324K, about $350K remains. If Binance covers Tron energy through staking, the result could be close to $650K. The Tron cost is our weakest measurement, based on a sample of 25 transactions.
In context, that is 0.01% of the $6.3B Binance says it is absorbing.
Hour by hour: the rush came early
Binance published a 30-minute chart for its first 9.5 hours. Grouped by hour, it lines up with our count.
| UTC | Out, Binance | Out, ours | In, Binance | Net, Binance |
|---|---|---|---|---|
| 06:00 | 475 | 468 | 29 | -446 |
| 07:00 | 604 | 517 | 42 | -562 |
| 08:00 | 1,243 | 1,263 | 306 | -936 |
| 09:00 | 649 | 600 | 107 | -542 |
| 10:00 | 304 | 377 | 145 | -159 |
| 11:00 | 355 | 361 | 74 | -280 |
| 12:00 | 334 | 339 | 93 | -241 |
| 13:00 | 310 | 300 | 121 | -189 |
| 14:00 | 281 | 271 | 65 | -216 |
| 15:00 | 94 | 100 | 28 | -67 |
| Total | 4,649 | 4,596 | 1,010 | -3,638 |
Amounts in millions of USD. The 15:00 row covers 30 minutes. Binance figures are read from its chart. Our count uses block time, so early bitcoin transfers can fall into a neighbouring window.
Binance's figures put 53% of the net outflow in the first three hours and 68% in the first four. The busiest hour was 08:00 to 09:00 UTC, with $1.24B out and $306M in.
Part of that shape comes from the rollout itself. Only bitcoin moved in the first 90 minutes, and the 15 networks were not all live until 12:36 UTC. Binance says withdrawal volumes then fell and stabilised, and that deposits stayed substantial.
What this data cannot tell you
- How many customers left. One person can use many addresses, and one exchange address can serve thousands of people. Binance founder Changpeng Zhao wrote that "98% choose to stay". Public chain data can neither confirm nor refute that.
- Where the money went. A transfer to an address outside the reserve list may still belong to Binance or a partner. CoinDesk reports net inflows of about $450M at OKX and $134M at Bybit, but those totals do not show how much came from Binance customers.
- Net flows after 15:30 UTC on 1 November. Users deposit to individual addresses that are not on the list, so this method sees withdrawals only.
- The final picture. Binance is still testing the remaining networks and assets, so this covers a first phase with limited routes.
- Shielded Zcash. Withdrawals to shielded addresses are not visible. We processed 293 of 295 Zcash transactions before hitting an API limit.
How we measured it
- Addresses. We took 669 network and address pairs from Binance's public proof-of-reserves API, including 73 entries added on 1 November.
- Withdrawals. We counted transfers from a listed address to an unlisted one, at or above the minimum withdrawal amount.
- Sources. Public RPC nodes and explorers for each network, including mempool.space, TronGrid, Blockscout, 3xpl and toncenter.
- Prices. DefiLlama prices at 12:00 UTC on 1 November (BTC $77,879, ETH $2,268, SOL $95.2).
- Exclusions. We removed $686M that did not look like customer withdrawals: $346.8M in bitcoin hot wallet top-ups, $300M in USDT to
0x5754284f…at 14:12 UTC and $39.3M in USDT on TON at 11:26 UTC. Without the last two, our 14:00 and 11:00 windows match Binance's chart closely. We could not identify either recipient. - Validation. Our count for Binance's official window is $4.596B, or 98.9% of its $4.649B, before native BNB, ETH on Base and Arbitrum, and POL.
- Sampling. Those four native coins could not be pulled without a paid index, so we sampled blocks. They add an estimated $18M to $58M and do not change the result.
FAQ
How much was withdrawn from Binance after the hack?
$6.96B in measured on-chain transfers in the first 26 hours after reopening, plus an estimated $18M to $58M in sampled native coins. Binance's own figure for the first 9.5 hours is $4.649B.
What was Binance's net outflow?
Binance reported $3.64B net for 06:00 to 15:30 UTC on 1 November. We estimate $5.5B to $5.9B by 08:00 UTC on 2 November. No official figure covers that longer window yet.
Did customers lose money in the hack?
Binance says it will absorb the loss and that it has replaced about 95% of the affected funds, with the rest in less liquid tokens. That is a company statement. It has not been independently audited.
How much did Binance earn from withdrawal fees?
At most about $675K gross and about $350K after network costs, based on public fee rates. Tron USDT accounted for most of it.
Why are the numbers different from DefiLlama?
DefiLlama tracks balance changes in known wallets, which also fall when Binance moves funds between addresses. We count transfers that leave the reserve list and exclude internal movements.
Sources
- CNBC: Binance sees $3.64 billion in net outflows
- CoinDesk: live updates on Binance outflows
- Binance on X: withdrawal update
- Bitcoin.com: Binance withdrawal chart and network list
- DefiLlama: Binance protocol data
- mempool.space, TronGrid, Blockscout, 3xpl, toncenter
For what happened during the attack itself, read our full timeline of the Binance hack. If you are comparing where to hold funds in the EU, see crypto exchanges in Europe: fees, MiCA entities and access.
This is data reporting, not financial advice. Figures are as of 2 November 2026 and may be revised when Binance publishes new reserve data.